Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,030

Export CSV
CVE-2019-14821

Kernel: KVM: OOB memory access via mmio ring buffer

An out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer 'struct kvm_coalesced_mmio' object, wherein write indices 'ring->first' and 'ring->last' value could be supplied by a host user-space process. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 5 more
Products
Ubuntu Linux Debian Linux Fedora and 38 more
CVE-2019-14813

ghostscript: Safer mode bypass by .forceput exposure in setsystemparams (701443)

A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.

CVSS 3.1 · 9.8 Critical EPSS 11.0% KEV · Not listed
Vendors
Artifex Debian Fedoraproject and 2 more
Products
Ghostscript Debian Linux Fedora and 10 more
CVE-2019-14744

kdelibs: malicious desktop files and configuration files lead to code execution with minimal user interaction

In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with minimal user interaction. This relates to libKF5ConfigCore.so, and the mishandling of .desktop and .directory files, as demonstrated by a shell command on an Icon line in a .desktop file.

CVSS 3.1 · 7.8 High EPSS 4.1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 7 more
CVE-2019-14287

sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command.

CVSS 3.1 · 8.8 High EPSS 63.8% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 18 more
CVE-2019-13764

chromium-browser: Type Confusion in V8

Type confusion in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 6.4% KEV · Not listed
Vendors
Debian Fedoraproject Google and 3 more
Products
Debian Linux Fedora Chrome and 7 more
CVE-2019-13763

chromium-browser: Insufficient policy enforcement in payments

Insufficient policy enforcement in payments in Google Chrome prior to 79.0.3945.79 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS 1.2% KEV · Not listed
Vendors
Debian Fedoraproject Google and 1 more
Products
Debian Linux Fedora Chrome and 5 more
CVE-2019-13762

chromium-browser: Insufficient policy enforcement in downloads

Insufficient policy enforcement in downloads in Google Chrome on Windows prior to 79.0.3945.79 allowed a local attacker to spoof downloaded files via local code.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Google and 2 more
Products
Debian Linux Fedora Chrome and 6 more
CVE-2019-13761

chromium-browser: Incorrect security UI in Omnibox

Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.

CVSS 3.1 · 4.3 Medium EPSS 1.1% KEV · Not listed
Vendors
Debian Fedoraproject Google and 1 more
Products
Debian Linux Fedora Chrome and 5 more
CVE-2019-13759

chromium-browser: Incorrect security UI in interstitials

Incorrect security UI in interstitials in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS 1.3% KEV · Not listed
Vendors
Debian Fedoraproject Google and 1 more
Products
Debian Linux Fedora Chrome and 5 more
CVE-2019-13758

chromium-browser: Insufficient policy enforcement in navigation

Insufficient policy enforcement in navigation in Google Chrome on Android prior to 79.0.3945.79 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS 1.2% KEV · Not listed
Vendors
Debian Fedoraproject Google and 1 more
Products
Debian Linux Fedora Android and 6 more
CVE-2019-13757

chromium-browser: Incorrect security UI in Omnibox

Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.

CVSS 3.1 · 4.3 Medium EPSS 1.2% KEV · Not listed
Vendors
Debian Fedoraproject Google and 1 more
Products
Debian Linux Fedora Chrome and 5 more
CVE-2019-13756

chromium-browser: Incorrect security UI in printing

Incorrect security UI in printing in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS 1.3% KEV · Not listed
Vendors
Debian Fedoraproject Google and 1 more
Products
Debian Linux Fedora Chrome and 5 more
CVE-2019-13755

chromium-browser: Insufficient policy enforcement in extensions

Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to disable extensions via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS 1.2% KEV · Not listed
Vendors
Debian Fedoraproject Google and 1 more
Products
Debian Linux Fedora Chrome and 5 more
CVE-2019-13754

chromium-browser: Insufficient policy enforcement in extensions

Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS 1.3% KEV · Not listed
Vendors
Debian Fedoraproject Google and 1 more
Products
Debian Linux Fedora Chrome and 5 more
CVE-2019-13753

sqlite: fts3: incorrectly removed corruption check

Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS 1.7% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 7 more
CVE-2019-13752

sqlite: fts3: improve shadow table corruption detection

Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS 1.7% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 7 more
CVE-2019-13751

sqlite: fts3: improve detection of corrupted records

Uninitialized data in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS 2.0% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 7 more
CVE-2019-13750

sqlite: dropping of shadow tables not restricted in defensive mode

Insufficient data validation in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass defense-in-depth measures via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS 2.4% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 7 more
CVE-2019-13749

chromium-browser: Incorrect security UI in Omnibox

Incorrect security UI in Omnibox in Google Chrome on iOS prior to 79.0.3945.79 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS 1.6% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 2 more
Products
Iphone Os Debian Linux Fedora and 6 more
CVE-2019-13748

chromium-browser: Insufficient policy enforcement in developer tools

Insufficient policy enforcement in developer tools in Google Chrome prior to 79.0.3945.79 allowed a local attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Debian Fedoraproject Google and 1 more
Products
Debian Linux Fedora Chrome and 5 more